Update json requirement from 3.0.0 to 3.0.1

[dependabot]

Updates the requirements on json to permit the latest version.

Changelog

Sourced from json's changelog.

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.
• Removed JSON::PRETTY_STATE_PROTOTYPE.
• Removed the insecure create_additions option.
• Removed JSON::GenericObject.

... (truncated)

Commits

• c557a62 Release 3.0.1
• 566bd7c Restore the limit positional argument of JSON.dump
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)